document-set-title-mutation-crash.html

<!DOCTYPE html>
<html>
<script>
var count = 0;
if (!window.testRunner)
    document.write("This test requires GCController.");
else {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();

    function crash() {
        if (++count > 1)
            return;
        document.open();
        document.write('PASS');
        document.close();
        GCController.collect();
        setTimeout("testRunner.notifyDone()", 0);
    }

    setTimeout(function () {
        document.write("<title>");
        document.title = "First Child";
        document.getElementsByTagName('title')[0].appendChild(document.createTextNode("Second Child"));

        document.addEventListener('DOMNodeRemovedFromDocument', function () { crash(); }, true);
        document.title = "New title";
    }, 0);
}
</script>
</html>

chromium/third_party/blink/web_tests/dom/mutation-event-tests/fast/dom/document-set-title-mutation-crash.html